Predicting – and coping with – pandemic panic

As of last night’s Presidential address to the Republic of South Africa, we’ve now joined the nations experiencing an official national emergency. And, like other places in the world who are already suffering much worse than we are, we too now are starting to experience pandemic panic buying and empty supermarket shelves of everything from toilet paper to eggs to bread to ground beef and chicken—along with a few other things I didn’t expect, like sweetcorn, broccoli and mushrooms.

Still plenty of Brussel Sprouts and cabbage hanging around for some reason though.

And that brings me to the subject of today’s email: how well we do to predict the potential panic when we’re building our BC/DR plans.

Because, as we all know humans are, well…unpredictable.

One of the worst mistakes you can make when you’re trying to plan for the unexpected is to assume that you can follow a predictable process when you can’t.

It comes back to understanding what you can actually control. The only things you can control are really yourself. Anything else is just an illusion—especially in a crisis situation like we’re all living through right now.

It’s pretty easy to address the broad strokes of any kind of BC/DR plan. After all, the objective of any of those kinds of plan comes from the “C” for being able to continue to operate (or, maybe just continue to exist) and the “R” for being able to recover those things that you can’t continue given the particular constraints of the kind of problem you’re trying to plan for.

Obviously, continuity requires some level of availability of your organizational resources, be they services, staff, technology and facilities…but you also can’t forget about the availability of two of the most critical things your organization has: it’s information and its financial resources.

Any kind of business continuity plan is about trade-offs, but those considerations need to be made in terms of the unpredictability of human behavior in a crisis. However, we’re not totally out there on our own as security in this respect—even though some of this stuff we’re faced with right now might be new.

I’m not going to go into it in great detail here, because it’s not really something that you can do justice to in an email. However, since it’s something that is very real – and we’re all facing both personally and organizationally right now – I wanted to at least give you some hooks for future investigation so you can potentially augment your thinking about your existing BC and DR plans as the reality of a global pandemic plays out around us.

The first model is something used by the Red Cross when talking about the emotional responses and phases people go through in a disaster. Unsurprisingly, it’s name is “the Four Phases of Disaster,” and they are:

The Heroic Phase – this is normally immediately following (or during) the disaster when people are doing what needs to be done to help people cope, survive and recover from a disaster.

The Honeymoon Phase – this phase is where people come together against a common enemy or for a common cause. This is also the basis of what binds the Level 4 Tribal Leadership organization together. Normally, this period lasts between a week or two and within 6 months of when the disaster takes place

The Disillusionment Phase – here’s where we see people revert to their most selfish “everyone for themselves” instincts, and it’s normally caused when people who’ve either been impacted by the event aren’t getting the promised responses by “the authorities” or when the coalitions of people who were empowered by all the goodwill and positive energy start hitting the barriers of reality in making their plans come to life. This phase can go from a couple of months to even years afterwards, depending on what kinds of things people go through and the scope of the impact. Given what we’re seeing now, I think it’s fair to say that the impact of what’s happening now will be with us for quite a while. It’s also useful to put this into perspective of the Tribal Leadership phases. In phase, you can see people in the whole range from Level 1, “Life Sucks” and everything seems beyond hope, to the eventually positive anger and motivation of Level 2, “My Life Sucks” that can help people move forward, and for those less impacted, you might even see people operating at Level 3, “I’m great (and you’re not).”

The Reconstruction Phase – when people finally realize they can only accomplish so much trying to go their own ways, and they again buckle down to change their current reality and get things done. Delays in progress can still cause resentment, but it’s normally marked by overall positive progress. From a Tribal Leadership level perspective, it could be either the positive movement from Level 2, “My Life Sucks” to Level 3, “I’m Great (and your not)” or it could take a large number of people from Level 3 back to a sustained period of working together for a common cause I talked about in Level 4, “We’re Great” above.

What’s important to understand here is that these are very much driven by the psychological factors of the people experiencing the event—whether it’s you, your customers or your communities, and ignoring that is going to cause you to severely fail to anticipate the kinds of swings and panic that might likely accompany the scenarios you’re trying to try and navigate.

Notice I didn’t say “manage” here, because that implies control, and you can’t control the outcome in this kind of situation. You can only influence it. But you can only influence it correctly if you’re aware of what to expect and how to understand where in the cycle/process you actually are.

Another model you might’ve seen is the one published by Jack Welch in the Wall Street Journal after Hurricane Katrina. That version is called “The Five Stages of Crisis Management” and it includes these:

Denial – an attitude of “it can’t happen here”

Containment – “burying it or passing the buck” by the leadership team

Shame-Mongering – “It’s not my fault. Did you see what they did? How could they not anticipate this would happen or how could they drop the ball/fail in some obvious way”

Blood on the Floor – “find the scapegoat and kill it” so that someone important and visible loses their job so people get some kind of vindication that justice has been done

The Crisis Gets Fixed – “building a better future with the knowledge of failure”

It’s illustrative to note the similarities and differences between the two models of crisis (and there are others I won’t go into now). You might be familiar with one or the other, and they may have even been the basis of the plans you’re hopefully executing now.

What I’m saying is that you can’t get attached to the models, the predictions or even a sequential view of any “phases” of a real crisis or disaster event. It’s like change programs, and the same kind of thinking is why so many of those fail too.

You have to recognize that everyone’s experiencing things differently, at different rates, and people may jump around between the “stages” or “levels”…and they may do it seemingly unpredictably.

Tomorrow I’m going to talk about a slightly simpler way to look at this purely from a psychological perspective that highlights the sentiments you need to make sure your plan is going to address in each area of your CIA or attribute-and-domain based BC/DR plan to keep the lights on and get things back to a “new normal.”

In the meantime, what I’d recommend we all do is try to find a moment to recognize where we all are on whichever model makes sense, where those around us are, and what we can do individually from where we are to help everyone get through this.

We’re well beyond the days when we could do it all on our own—if we ever even could. Of course, I still have to keep the lights on too, so if you want to talk about some of this directly and see if maybe there’s a way I can help youu, that’s always an option by visiting this link:

But all the help in the world is pretty useless if we don’t know we’re ready for it, and that applies just as much to your security customers and the customers of your organizations who are all going to be facing their own path through this crisis roller-coaster.

Be mindful of them – and of you – as we all try and stay sane, healthy and safe over the coming weeks and months.

EMAIL NEWSLETTER

Want to get DAILY email tips on how to build a more effective security program so you can prove your security investments deliver value to the business?

Your nameYour best email

I understand and agree that when I sign up above, I will be added to a marketing mailing list where I will receive DAILY security leadership tips and promotional offers from Andrew S. Townley according to the terms of Archistry's privacy policy and site terms and conditions.

You can always unsubscribe at any time, and we won't sell your data to third parties.

About Us

Archistry works with you to ensure what you want to achieve actually gets done, linking strategy, risk, governance and compliance to enable sustained exceptional performance Read More…

Testimonials

Andrew is a highly skilled and experienced information systems
architect and consultant, which in my view is a rare thing. He is
innovative in his thinking and merits the title of 'thought
leader' in his specialist domains of knowledge—in particular the
management of risk. Andrew has embraced SABSA as a framework and,
in doing so, has been a significant contributor to extending the
SABSA body of knowledge."

— John Sherwood, Chief SABSA Architect

"Fabulous person to work with. Very engaging and insightful. Extremely
good technical knowledge with ability to relate concepts together and
overcome differing opinions. Makes things work."

"Andrew was able to bring clarity and great depth of knowledge to the
table. His breadth of thinking and understanding of the business
and technical issues along with a clear and effective
communication style were of great benefit in moving the process
forward towards a successful conclusion."

— Doug Reynolds, Product Manager, MobileAware

"Andrew is a fabulous consultant and presenter that you simply
enjoy listening to, as he manages to develop highly sophisticated
subjects in very understandable way. His experience is actually
surprising and his thoughts leave you without considerable
arguments for any doubts in the subjects he covers."